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Abstract 

We investigate Quantum Key Distribution (QKD) relaying models. Firstly, we propose a novel 
quasi-trusted QKD relaying model. The quasi-trusted relays are defined as follows: (i) being honest 
enough to correctly follow a given multi-party finite-time communication protocol; (ii) however, 
being under the monitoring of eavesdroppers. We develop a simple 3-party quasi-trusted model, 
called Quantum Quasi- Trusted Bridge (QQTB) model, to show that we could securely extend 
up to two times the limited range of single-photon based QKD schemes. We also develop the 
Quantum Quasi- Trusted Relay (QQTR) model to show that we could securely distribute QKD 
keys over arbitrarily long distances. The QQTR model requires EPR pair sources, but does not 
use entanglement swapping and entanglement purification schemes as proposed ini^. Secondly, 
we show that our quasi-trusted models could be improved to become untrusted models in which 
the security is not compromised even though attackers have full controls over some relaying nodes. 
We call our two improved models the Quantum Untrusted Bridge (QUB) and Quantum Untrusted 
Relay (QUR) ones. The QUB model works on single photons and allows securely extend up to 
two times the limited QKD range. The QUR model works on entangled photons but does not 
use entanglement swapping and entanglement purification operations. This model allows securely 
transmit shared keys over arbitrarily long distances without dramatically decreasing the key rate 
of the original QKD schemes. 
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I. INTRODUCTION 



The limited range of Quantum Key Distribution (QKD) link is one of the most headache- 
questions to many researchers for a long time. The earliest QKD protocol^ is the BB84 
protocol that had been proposed by Bennett and Brassard in 1984. After, this protocol 
was proven to be unconditionally secure^ 1 ^, and promised the vast potentially worthful 
applications. As the cost due of its extremely good security, unfortunately, QKD owns 
undesirable restrictions over range and rate*^. This explains why there are few practical 
QKD applications so far. Today, improving QKD range's approaches can be roughly divided 
into two categories. The first one is improvements over direct QKD links, for instance, 
perfecting quantum devices as quantum sources and quantum detectors. The second one is 
QKD relaying methods that allow to securely relay QKD keys. This paper addresses the 
latter one. We will assume that we work with perfect quantum devices, free-error quantum 
channels to focus on the "relaying" aspect. 

Our main contributions are : 

1. The proposal of a new concept called "quasi-trusted relay" that seems reasonable in 
realistic scenarios, 

2. The Quantum Quasi- Trusted Bridge (QQTB) model that allows to securely extend up 
to two times the QKD range without invoking entanglement-based operations, 

3. The Quantum Quasi- Trusted Relay (QQTR) model that allows to securely distribute 
shared keys over arbitrarily long distances without invoking entanglement swapping 
and entanglement purification operations, 

4. The Quantum Untrusted Bridge (QUB) model that allows to securely extend up to 
two times the QKD range without invoking entanglement-based operations, 

5. The Quantum Untrusted Relay (QUR) model that allows to securely distribute shared 
keys over arbitrarily long distances without invoking entanglement swapping and en- 
tanglement purification as proposed ini^. 

The remainder is organized as follows. Section [TT] gives an overview of previous works on 
QKD relaying models and introduces our motivation. Section HTT1 reminds some background 
concept and also makes some propositions that are used in our proposed models. We define 
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our "quantum quasi-trusted" concept in Section HVl Section IVl develops the Quantum Quasi- 
Trusted Bridge (QQTB) model that is capable of securely doubling the range of single-photon 
based QKD schemes. Section IVT1 develops the Quantum- Trusted Relay (QQTR) model that 
is capable of securely distributing shared keys over arbitrarily long distances. Section IVHI 
develops the Quantum Untrusted Bridge (QUB) model that is capable of securely doubling 
the range of single-photon based QKD schemes, in releasing all constraints of the relaying 
node. Section IVlIII develops the Quantum Untrusted Relay (QUR) model that is capable of 
securely distributing shared keys over arbitrarily long distances, in releasing all constraints 
of relaying nodes. We conclude in Section [IX] 

II. RELATED WORK AND MOTIVATION 

1. Related work. 

Since the range of QKD is limited, QKD relaying methods are necessary. This becomes 
indispensable when one aims at building QKD networks as in the last recent years. All QKD 
relaying methods so far introduce some undesirable drawbacks. The most practical method 
is based on trusted model. This method has been applied in two famous QKD networks, 
DAPRA and SECOCQii^'^'M In this method, all the relaying nodes must be assumed 
perfectly secured. Such an assumption is critical since passive attacks or eavesdropping on 
intermediate nodes are very difficult to detect. A few number of intermediate nodes could 
lead to a great vulnerability in practice. Consequently, one wants to limit the number of 
trusted nodes in QKD networks. 

One could claim that the idea of the quasi-trusted QKD relaying model is not new. The 
works ini&ii&il were indeed based on such an idea. However, the "quasi-trusted" property 
was characterized differently and had been analyzed in a different context: each node was 
assumed to be trusted with a high probability p ~ 1, and the main focus was the security 
behavior of the global system that consists of a great number of nodes. In this paper, 
we propose a very different concept of "quasi-trusted" that is characterized by: (i) being 
honest enough to correctly follow a given multi-party finite-time communication protocol; 
(ii) however, being under the monitoring of eavesdroppers. 

Theoretically, the most strong QKD relaying model so far is the one that is based on 
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entanglement swapping (QS) operational^. This QS-based relaying model allows to achieve 
an arbitrarily long-distance QKD. The idea is roughly described as follows. One first in- 
crementally build a more long distance EPR pair from two less long distance EPR pairs by 
a number of complicated quantum operations as entanglement purification, entanglement 
swapping, etc. The goal of this step is to create EPR pairs shared between the two tar- 
get nodes (origin and destination) that are in an arbitrarily long distance far away. Then, 
these two nodes could do an entanglement-based BB84 protocol to establish the secret key. 
Besides the capacity over arbitrarily long distances, another advantage of the QS-based re- 
laying model is that this model allows to effectively detect eavesdropping at relaying nodes. 
Indeed, this model could be considered as untrusted-model. 

2. Motivation. 

Although the QS-based relaying model gives a very beautiful result in theory, working 
on entangled photons is not easy in practice. In compared with single-photon approaches, 
entanglement-based ones seem to be surcharged by the quickly unavoidable decoherence of 
entangled photons over transmission and in time. This fact encourages us looking for new 
relaying methods that restrict the use of entangled photons, or at least effectively decrease 
the time conserving entangled photons to get more easy in practical implementations. 

Therefore, we first propose the Quantum Quasi- Trusted Bridge (QQTB) model that is 
capable of doubling the limited QKD range without invoking entanglements. Then, we 
propose the Quantum Quasi- Trusted Relay (QQTR) model that could be considered as an 
extended-QQTB version. The QQTR model is capable of securely distributing shared keys 
over arbitrarily long distances. This model works with entangled photons, but does not need 
invoke entanglement swapping and entanglement purification as proposed ini^. As a result, 
we could effectively decrease the time required for conserving the coherence of entangled- 
photons in compared to previous works. However, the most originality of our works is two 
untrusted models: the Quantum Untrusted Bridge (QUB) and Quantum Untrusted Relay 
(QUR) ones. The QUB and QUR models have the same capacity with the QQTB and 
QQTR ones in the range point of view, respectively. However, the QUB and QUR models 
allow to deal with untrusted intermediate nodes as models proposed ini^. That means that 
the origin and the destination could effective detect eavesdropping even though attackers 
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have the full controls over some intermediate nodes. 



III. BACKGROUND 

We remind some background concepts and make some propositions that are used to build 
our four models in the rest of this paper. 



A. The controlled-NOT (C-NOT) gate 



\x) 



\x) 



\y) \x®y) 



FIG. 1: The two-qubit controlled-NOT (C-NOT) gate, also called the XOR gate. 



Our models need use the quantum controlled-NOT (C-NOT) gate (see FigJT]). The BB84 
protocol does not need use this gate, however, entanglement swapping and entanglement 
purification operation require this gate*^. In fact, the C-NOT gate is one of the most 
popular two-qubit quantum gates22>2i. Without loss of generality, we will work only with 
the C-NOT gate that operates in basis |+) with two corresponding basis states |0) and |1). 
By definition, this gate flips the second (target) qubit if the first (control) qubit is |1) and 
does nothing if the control qubit is |0). 

Proposition 1. If two input qubits are basis states of one sole basis, then: 

1. For the case of the input basis being \+), the XOR of two input qubits appears at the 
second output (exactly as described in Fig. 

2. For the case of the input basis being |x), the XOR of two input qubits appears at the 
first output (not as described in Fig. Q]). 

Proof: The two basis states of the basis |+) are |0) and |1), corresponding to logical 
values Ol and 1l, respectively. Consequently, the two basis states of the basis |x) are ^ip- 
and ^75, corresponding to logical values Ol and 1l, respectively. As mentioned above, the 
C-NOT gate operates in basis |+). 
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If the two input qubits are in basis |+), then by the definition of the C-NOT gate we 
have: 
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Obviously, the XOR appears at the second output for the case of the input basis being 
+), exactly as described in Fig. [TJ 
We now observe the case in which two input qubits are in basis | x ) . 



|0) + |1> |0) + | 


l K 


1 


V2 ' \/2 




->— 
2 


|o)-|i) |0) + | 




1 


V2 y/2 




2 


|0) + |1) |0)-| 


l >> 


1 






->— 
2 


|o)-|i) |o> — | 


l >> 


1 


y/2 V2 




2 



\0l)-\0l) 
\U).\0l) 

We realize that the C-NOT gate now changes the roles of two input qubits. If the second 
qubit is I/, (in basis |x)) then it flips the first qubit (in basis |x)). Otherwise, it does 
nothing. The XOR (in basis | x )) is at the first output in this case, not as described in Fig. [T] 

Proposition 2. If the two input qubits of the C-NOT gate are basis states in the different 
basis (one in |+) and other in \ x)), then 

1. If the first and second qubits are basis states in basis |x) and \+), respectively, then 
the output is an entanglement. 

2. If the first and second qubits are basis states in basis |+) and |x), respectively, then 
the C-NOT gate does nothing. 

Proof: If the first (control) and second (target) qubits are the basis states in basis |x) 
and |+), respectively, then we have: 
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Obviously, the output is an entanglement, more precisely, one of four Bell states if the 
first and second qubits are in basis |x) and |+), respectively. 

If the control and target qubits are the basis states in basis |+) and |x), respectively, 
then we have: 

mx ■ mvMU ,„x |0> + |1> 
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Obviously, the C-NOT does nothing in this case. 



B. A simple quantum circuit 
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FIG. 2: The pair (|aj), |6j)) passes through a C-NOT gate operating in basis |+) before being 
measured independently: the first output qubit is measured in basis | x ) and the second one is 
measured in basis |+). 



In fact, we use the C-NOT gate to build a simple quantum circuit as described in Fig. [2J 
It has two inputs and two outputs. The two input qubits first pass through a C-NOT gate 
operating in basis |+), and then are measured independently by two quantum detectors that 
operate in different basis |x) and |+) (see Fig. [2]). The two outputs are classical bits or 
1. We can directly deduce from Proposition [1] to the following proposition. 
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Proposition 3. If two input qubits are basis states of one sole basis, then the quantum 
circuit as described in Fig. [H does an irreversible XOR operation. This circuit reveals no 
more information than the logical XOR of two logical inputs. Indeed, 

1. If two input qubits \a) and \b) are in the same basis \+), then the second output is 
(cjl © bi) and the first output is either or 1 with equal probabilities (50% for each 
one), where at, and b^ are logical values of states \a) and \b) in basis \+), respectively. 

2. If two input qubits \a) and \b) are in the same basis |x) then the first output is (ol©&l) 
and the second output is either or 1 with equal probabilities (50% for each one), where 
ai and bi are logical values of states \a) and \b) in basis \ x), respectively. 

C. EPR pairs - Bell states 

A Bell state (or an EPR pair) is defined as a maximally entangled quantum state of 
two qubits. These qubits could be spatially separated, however, they always exhibit perfect 
correlations. Assume that Alice and Bob share one of four Bell states |$ + ) = -^(| \a\b 
) + I IaIb))- If Alice and Bob measure their qubits in any common basis at their spatially 
separated sites, then Alice will get a random logical output either 0^ or 1 L with each prob- 
ability of 50% and the output of Bob is always parallel with that of Alice (i.e. the same 
value) . 

If we focus on the logical values then we could describe four Bell states that form an 
orthogonal basis for the quantum state of two qubits as follows: 

= |0 L L ) ± \1 L 1 L ) = |0 L 1 L ) ± \1 L L ) 

IV. QUANTUM QUASI-TRUSTED (QQT) RELAYS 

Let us observe a three-party communication scenario as follows. The origin Alice wants 
to establish a secret key with the destination Bob. They want to achieve unconditional 
security. However, the distance between them exceeds the limited range of QKD. Carol is a 
intermediate node that could share QKD links with Alice and Bob. It seems reasonable to 
assume that Carol is honest enough to correctly follow a given three-party communication 
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protocol even though she is eavesdropped by the malicious person Eve. In such a scenario, 
we call Carol a quasi-trusted relay. 

Definition 1 (QQT relay). A Quantum Quasi-Trusted (QQT) relay is a person or a station 
that can execute simple quantum operations as measurement, C-NOT, etc., and holds the 
following conditions : 

1. Finite-Time Trust: The relay is honest enough to correctly implement a given finite- 
time communication protocol. After having done the protocol, the relay could be cor- 
rupted. 

2. Under eavesdropping: The relay could be always under the monitoring of eavesdrop- 
pers. 

Our quasi-trusted relay definition is simple but very important since we will use it to build 
the Quantum Quasi- Trusted Bridge (QQTB) and Quantum Quasi- Trusted Relay (QQTR) 
models in the next of this paper. 

V. QUANTUM QUASI-TRUSTED BRIDGE (QQTB) MODEL 
A. Description 

Definition 2 (QQTB model). The QQT-bridge (QQTB) model is a three-party communica- 
tion model in which the QQT relay Carol acts as a bridge that helps two long-distance nodes 
Alice and Bob to securely establish a shared key. The Fig. [3] roughly describes a QQTB 
model. 

The QQTB model uses an implicit assumption that Eve cannot eavesdrop the origin Alice 
and the destination Bob. Such a assumption is trivial since if the origin or the destination is 
eavesdropped then there is no solution for Alice and Bob. Our definition of the QQTB model 
also implies that Eve is allowed to execute classical and quantum attacks over the channels 
Alice-Carol and Carol-Bob, even over Carol's site. At the first glance, we realize that the 
most dangerous vulnerability is from the Carol's site. Indeed, although the two channels 
Alice-Carol and Carol-Bob could be secured by QKD (see Fig [3]), if information appears in 
clear at the Carol's site then Eve could get it without leaving any trace by eavesdropping. 
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FIG. 3: QKD bridge: Alice and Bob are out of the QKD range, they want to use Carol as a bridge 
to communicate securely the shared key. 

B. Protocols 

The problem is how we could design secure three-party communication protocols that 
satisfy the constraints of the QQTB model, implicitly, that hold the conditions of the QQT 
relay (see Definition [1]). We develop a simple idea that is based on the one-time pad un- 
breakable encryption scheme. The idea could be described as follows. We try to create the 
situation in which Alice, Carol and Bob own three pads A, C, B, respectively. These pads 
hold C = A © B (a bit- wise XOR operation). Note that Carol owns C and knows no more 
than C = A © B. When Alice wants to send to Bob a secret key K, she sends K © A 
to Carol. Carol receives K © A, computes K © A © C = K © B, and sends the result to 
Bob. Bob receives K © B, computes K © B © B to obtain K. In such a situation, even 
though Carol owns C = A © B, she cannot reveal K. Besides, the key K is unconditional 
secured over channel since we use the one-time pad scheme. Obviously, Carol holds the 
under eavesdropping condition (see Definition [1]) and could be developed to become a QQT 
bridge. 

We will begin with a classical protocol that illustrates our approach. This protocol is not 
secure. Then we turn into quantum world to see how quantum mechanics could help. 

1. The Insecure Quasi- Trusted Bridge (IQTB) protocol: 
The protocol consists of the following steps. 

1. Alice securely sends to Carol a random m-bit string A by a QKD link. 

2. Bob securely sends to Carol a random m-bit string B by a QKD link. 

3. Carol receives A and B, computes C = A © B (XOR operation). 

4. Carol deletes A and B in her memory device. 
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5. Transmitting the secret key: 

• Alice randomly creates the m-bit key K, sends K © A to Carol. 

• Carol receives K © A, computes K © A® C = K © B, then sends the result to 
Bob. 

• Bob receives K ffi B, computes K © B © B to obtain K. 

What is insecure in this protocol? The step 4 seems helpful in face with the finite-time 
trusted condition of the quasi-trusted bridge: after having done the protocol, even though 
Carol is corrupted the key K is not compromised. But this is not so! Nobody can sure 
that in the one hand Carol still does correctly the protocol but in the other hand she makes 
copies of A and B, maybe only for her curiousness purpose. And then, when the protocol has 
been yet finished, she could be corrupted and gives these copies to Eve. Consequently, the 
key K is compromised. More seriously, the protocol cannot hold the under-eavesdropping 
condition (see Definition [T]). Indeed, if Eve could monitor Carol's memory devices, then 
she can make herself copies of A and B. If A or B is compromised then the key K is 
compromised, consequently. 

Now, we propose the Quantum Quasi- Trusted Bridge (QQTB) protocols that really help 
Alice and Bob to securely establish the shared key K through the bridge Carol. These 
protocols could defeat drawbacks of the previous protocol. 

2. The Quantum Quasi-Trusted Bridge (QQTB) Protocol: 

The protocol consists of 4 main steps. 

Step 1: Preparing, exchanging, and measuring qubits. 

1. Alice creates 2n random bits and chooses the random 2n-bit string 6^. For each bit 
i, she creates a state in basis |+) or |x) if b^fi] = or = 1, respectively. Alice 
sends the resulting qubits |ai,a 2 , ..,a 2n ) to Carol. 

2. Similarly, Bob creates a random 2n-bit value, the random 2n-bit string 6g and the 
corresponding qubits |6i, 62, .., &2n)- Then, he sends \b\, 62, .., &2n) to Carol. 

3. Carol receives two 2n-qubit strings from Alice and Bob in a synchronous manner. It 
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means that she receives one by one for all the 2n pairs (\cii), Ih)). On the arrival of a 
pair, Carol randomly turns into either Check-Mode (CM) or Message-Mode (MM). 

• In the CM, Carol measures independently both |aj) and \bi) in a randomly chosen 
basis |+) or |x). She gathers both two resulting bits and keeps track of their 
corresponding basis. Note that in this mode Carol does not use the quantum 
circuit described as Fig. [21 

• In the MM, Carol first leads |aj), \bi) to two inputs of a C-NOT gate, and then 
measures the two outputs in two different basis: the first one in | x ) and the 
second one in |+) as described in Fig. [2j She randomly chooses one out of two 
outputs to keep the measured value and the corresponding basis. She discards 
the another one. 

At the end of the receiving process, the CM and MM's choices roughly result in two 
n-position strings: the check-position string CP = cp\, .., cp n and the message-position 
string MP = mpi, .., mp n . 

Step 2: Checking for the presence of Eve. 

1. For the channel between Alice and Carol: Alice and Carol communicate their basis 
used in the check-positions CB and the corresponding values. They discard positions 
where their basis are different. They compare values at remaining positions. If some 
of these values agree, they conclude that the channel was compromised. In this case, 
they inform to Bob to abort the whole protocol. 

2. For the channel between Bob and Carol: Bob and Carol communicate their basis used 
in the check-positions CB and the corresponding values. They discard positions where 
their basis are different. They compare values at remaining positions. If some of these 
values agree, they conclude that the channel was compromised. In this case, they 
inform to Alice to abort the whole protocol. 

Step 3: Creating the pads for Alice, Carol and Bob. 

1. Alice, Carol and Bob announce their basis used in positions MB = mpi, ..,mp n . 

2. If their basis are different at mpi, then they discard this position and the corresponding 
values. 
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3. The values of the remaining positions result in three pads A = A\, ..,A m ;C = 
C\, ..,C m ; B = Bi,..,B m for Alice, Carol and Bob, respectively. These pads hold 
Q = Ai® B h i<E [l,..,m],m ~ f. 

Step 4: Transmitting the key K. 

1. Alice creates the random m-bit key K. She sends K © A to Carol. 

2. Carol receives from Alice K © A, does a XOR operation over it and her pad, then 
sends the result to Bob. Since C = A © B, the result of the XOR operation is 
K@A@C = K@B. 

3. Bob receives K © B, computes K © B © B to obtain K. 

We show now why this protocol is secure. At the step 1, when a pair (|a^) , \bi)) syn- 
chronously arrives to Carol, she randomly turns into either the Check-Mode (CM) or the 
Message-Mode (MM). Since Eve does not know in advance the choices of Carol, she cannot 
treat differently the pairs (|ct;), |6;)). Therefore, the error-rate on the check bits must behave 
like that on the message bits. In the other hand, the error-check procedures in the channels 
(Alice, Carol) and (Carol, Bob) are done exactly as that of the BB84 protocol. By that, the 
QQTB protocol's security is exactly the security of the BB84 protocol. This implies that 
the QQTB protocol is unconditionally secure. Readers being interested in security proof of 
BB84 are invited to read^ 1 ^. 

One can claim that Carol could unintentionally select some choices of CM or MM before 
arrivals of (|ai), \ bi)). If Eve knows these choices by eavesdropping, then she avoids the pairs 
in CM and attacks on the pairs in MM. This makes security compromised. We propose 
another protocol that can tolerate such a mistake of Carol. 

3. The modified- QQTB Protocol: 

The protocol consists of 5 main steps. 

Step 1: Preparing, exchanging, and measuring qubits. 

1. Alice creates 2n random bits and chooses the random 2n-bit string bA- For each bit i, 
she creates a state in a basis |+) or |x) for = or = 1, respectively. Alice 
sends the resulting qubits \a±, a^, ■•, a 2n ) to Carol. 
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2. Similarly, Bob creates a random 2n-bit value, the random 2n-bit string bs and the 
corresponding qubits \bi, 62, ••, &2n}- Then, he sends [61, &z, --, &2n) to Carol. 

3. Carol receives two 2n-qubit strings from Alice and Bob in a synchronous manner. It 
means that she receives one by one for 2n pairs (|af), |6»)). For each pair, Carol first 
leads |ctj), \ bi) to the C-NOT gate and then measures two output qubits in two different 
basis: the first one in |x) and the second one in |+) as described in Fig. [2j Then, 
she randomly chooses one out of two outputs to keep the measured value and the 
corresponding basis. She discards the other one. 

Step 2: Sifting. 

1. Alice, Carol and Bob announce their basis. 

2. If their basis are different at the position i, then they discard this position. 

3. The values of the remaining positions result in three 2m-bit strings a — 01, .., a2 m ; c = 
Ci,.-,c 2m ;6 = &i,..,&2m for Alice, Carol and Bob, respectively. Theoretically, these 
three strings hold q = Oj ffi bi,i G [1, 2m], 2m ~ ^p. 

Step 3: Checking for the presence of Eve. 

1. Alice, Carol, Bob randomly agree m out of 2m positions to check the presence of Eve. 
This results in two m-position strings: the check-position string CP = cpi, .., cp m and 
the message-position string MP = mpx, .., mp m . 

2. Alice, Carol, Bob announce their values a cpi ,b cpi , c cpi , respectively, in check-positions 
cpi. They check if c cpi = a cpi © b cpi or not. If some of negative checks, they abort the 
protocol. 

Step 4: Creating the pads for Alice, Carol and Bob. 

1. The values in m message-positions result in three m-bit pads A = Ai, .., A m ; C = 
Ci, ..,C m ; B = B 1 ,..,B m for Alice, Carol and Bob, respectively. These pads hold 
d = A i @B i ,ie [l,..,m],m ~ f. 

Step 5: Transmitting the key K. 

1. Alice creates the random m-bit key K. She sends K © A to Carol. 
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2. Carol receives K © A from Alice, does a XOR operation over it and her pad, then 
sends the result to Bob. Since C = A © B, the result of the XOR operation is 
K®A®C = K®B. 

3. Bob receives K © B, computes K © B © B to obtain K. 

This protocol makes sure that measurements are done before check-position and message- 
position choices. The classical information that could be eavesdropped by Eve on the Carol 
site now does not reveal any information of K. We must show that the protocol is secure in 
faced against Eve's attacks over channel. From our three-party communication model, we 
build a virtual two-party communication between Anna and Borris in which: 

1. Anna plays the roles of both Alice and Bob. 

2. Borris plays the role of Carol. 

3. The virtual channel between Anna and Borris consists of both two real channels (Alice, 
Carol) and (Carol, Bob). 

Let Anna and Borris do our modified QQTB protocol. We realize that Anna and Borris 
do a variant of the BB84 protocol that takes the same principles. Anna codes a classical 
bit by non-orthogonal quantum states \qi)\q2)i where | <^ 2 ) ar e simultaneously in basis 
|+) or |x). Borris receives a classical bit by measuring \q\ © q2) in a random basis |+) or 
|x). If his basis choice is right then the receiving value is exactly qi © q^. Otherwise, the 
receiving bit has a probability of 50% to be right. Eve cannot attack such a conjugate code 
without introducing more disturbances over channel. By estimating the disturbance, we 
could detect the presence of Eve over the virtual channel. This implies that we can make 
sure either the channels (Alice, Carol) and (Carol, Bob) are attacked or not as in the BB84 
protocol. In other words, our modified QQTB protocol is unconditionally secure. Readers 
being interested in security proof of BB84 are invited to read^ 1 ^. 

4- The enhanced- QQTB Protocol: 

In the modified-QQTB, we realize that if Alice and Bob use a common basis at the position 
i, then the quantum circuit at the Carol site gives no more information than the logical XOR 
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of two logical values of Alice and Bob. Therefore, no need to force Carol randomly choosing 
to keep one output (one measuring basis) before Alice and Bob announcing publicly their 
basis. The enhanced-QQTB protocol is very similar to the modified-QQTB ond. But it 
could improve the secret-bit rate up to two times. 

The enhanced QQTB consists of 5 steps. 

Step 1: Preparing, exchanging, and measuring qubits. 

• Alice, Carol, Bob do as in the modified QQTB protocol. However, instead of keeping 
only one output, Carol keeps informations of both two outputs. 

Step 2: Sifting. 

• Alice and Bob announce their basis: if the basis are different at the position i, then 
Alice, Bob, and Carol discard the position %. 

• For each remaining position i, Carol keeps only informations (value and basis) of either 
the first output or the second one if the common basis used by Alice and Bob is | x ) 
or |+), respectively. She discards informations of the other one. 

• Now, the values of the remaining positions result in three 2m-bit strings a = 
ai, ..,a 2m ;c = Ci,..,c 2m ;6 = &i,..,6 2m for Alice, Carol and Bob, respectively. The- 
oretically, these three strings hold q = © bi, i G [1, 2m], 2m ~ 

Step 3: Checking for the presence of Eve. 

• Alice, Carol, and Bob do exactly as in the modified QQTB protocol. 
Step 4: Creating the pads for Alice, Carol and Bob. 

• Alice, Carol, and Bob do exactly as in the modified QQTB protocol. 
Step 5: Transmitting the key K. 

• Alice, Carol, and Bob do exactly as in the modified QQTB protocol. 

Note that the security of enhanced QQTB protocol is exactly that of the modified QQTB 
protocol since the quantum circuit at the Carol site reveals no more than the XOR result 
and the qubit measurements are always done before Alice and Bob revealing theirs basis. 
Eve always deals with unknown states as in the modified-QQTB protocol. Therefore, the 
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enhanced-QQTB protocol also gives unconditional security. However, the number of secret 
bits obtained from the enhanced QQTB protocol is two time bigger than that of the modified 
QQTB protocol (see m in the step 2). 

VI. QUANTUM QUASI-TRUSTED RELAY (QQTR) MODEL 

A. Is is possible to extend QQTB model over arbitrarily long distance? 

The information theory states that Alice and Bob cannot publicly agree a common secret 
unless they pre-possess a secret key that has the length at least equal to that of the secret^. 
The quantum mechanic opens a new door that allows Alice and Bob to achieve their goal. 
Indeed, the quantum no-cloning theorem states that it is impossible to make a perfect copy 
of un unknown quantum state. This implies that eavesdropping on quantum channels will 
introduce some detectable disturbance. By estimating the error rates, Alice and Bob can 
effectively detect the presence of the eavesdropper Eve. 

In this paper, we study quantum models that work with perfect quantum devices, quan- 
tum free-error channels, and without quantum memory devices. Note that although the 
quantum channels are assumed free-error, we should take into account the degradations of 
single-photon energy and entangled-photon coherence over transmission. We assume that 
our quantum devices are perfect if and only if the single-photon energy and the entangled- 
photon coherence are above some given thresholds. In QQTB model, we implicitly address 
single photon schemes to avoid difficulties arising from entanglement decoherence. The ques- 
tion is whether we could extend this model based on single photon up to an arbitrarily long 
distance? We observe the scenario in which there is Dave in the right of Bob. Now Bob 
plays the role of quasi-trusted relay as Carol. The goal is that Alice could convey a secret to 
Dave, not to Bob. Assume that the distances between Alice, Carol, Bob and Dave are the 
critical distances of single-photon transmission over that transmitted qubits are correctly 
detected. In other words, Alice cannot send directly a single photon to Bob or Dave, and 
Dave cannot send directly a single photon to Carol or Alice. Therefore, Alice and Dave 
cannot make together a quantum contact at one unique intermediate location as the spirit 
of the QQTB model. In the other hand, any classical contact is no help. Therefore, we could 
conclude that the single-photon based QQTB model cannot extend more than two time of 
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the limited QKD range. This makes the senses of the word "bridge" in the QQTB model: 
two bridges cannot be build successively. 



B. Quantum Quasi- Trusted Relay (QQTR) model 



1. QQTR model's description. 



We take into account EPR pairs to build our QQTR model. As mentioned in Section HT1 
we try to limit the time keeping EPR pairs to avoid difficulties arising from entanglement 
decoherence. Such a motivation makes our works distinguished from the works presented 



ir>ii^^. 



The QQTR model is roughly described as FigJU 



Alice 



Carol 1 
(Quantum circuit 
as Fig. 2) 



Carol 2 
(Quantum circuit 
as Fig. 2) 



Carol N 
(Quantum circuit 
as Fig. 2) 



Bell 1 
(EPR source) 



Bell 2 
(EPR source) 



Bell N+l 
(EPR source) 



FIG. 4: Bell 1,.., Bell N are EPR-pair sources. Carol 1, .., Carol N act as Carol in the enhanced- 
QQTB protocol. 



2. QQTR protocol. 

Between Alice and Bob we arrange N Carols (Ci,..,CV for short) and N + l Bells 
(£>i, .., B N+ i for short) as described in FigJU This creates 2N + 2 segments. Without loss 
of generality, we assume that the length of segments are the same and the segment length 
allows our quantum devices working correctly and effectively on entanglement coherence and 
single-photon detection. 

Our QQTR protocol consists of 5 steps: 

Step 1: Preparing, exchanging, and measuring qubits. 

1. For Bi, .., B N+ i, each prepares n Bell states (|$ + )) n . 

2. B\ sends the first half of each Bell state to Alice (the previous), the second half to 
C\ (the next). B^+\ sends the first half of each Bell state to Cn (the previous), the 
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second half to Bob (the next). For % G [2, N], Bi sends the first half of each Bell state 
to Cj_i (the previous), the second half to C, (the next). 

3. Each Ci, i G [1, N], receives 2n qubits from Bi and Bi + \ in a synchronous manner. This 
means that she receives n times, and for each time she leads the qubit from Bi and 
the qubit from B i+t to the first and second inputs of the quantum circuit as described 
in Fig. [2j Then, she keeps informations (the measured value and the corresponding 
basis) of both two outputs. Briefly, Cj acts exactly as Carol in the enhanced-QQTB 
protocol. 

4. Alice and Bob receive n qubits for each one. They randomly choose basis to measure 
their qubits, independently. 

Step 2: Sifting. 

1. Alice and Bob announce their n basis used. 

2. If the basis are different at the position i, then Alice, Bob, Ci,..,Cjv discard this 
position. 

3. For each remaining position i, Ci, ..,Cn keep only informations (value and basis) of 
either the first output or the second output if the common basis of Alice and Bob is 
|x) or |+), respectively. They discard informations of the other one. 

4. The values of the remaining positions result in N + 2 2m-bit strings a = 
a u .., a 2m ; c(i) = c(i) u .., c(i) 2m , i = 1~N; b = h, .., b 2m for Alice, C 1} .., C N , and Bob, 
respectively. These A + 2 strings should hold (&f=i c(i)j = a j © 6j , z G [1, 2m], 2m ~ |. 

Step 3: Checking for the presence of Eve. 

1. Alice, Bob, and Ci,..,Cjv randomly agree m out of 2m positions to check the 
presence of Eve. This results in two m-position strings: the check-position string 
CP = cpi, .., cp m and the message-position string MP = mpi, .., mp m . 

2. Alice, Bob, Ci,..,CV announce values in check-position a = a cpi , .., a cpm , b = 
b cpi ,--,b cpm ,c(i) = c(i) cpi ,..,c(i) cpm ,i = 1..N, respectively. They check if 
(BiLi c (^)cpj — a cpj ffi b cPj or not. If some of negative checks, they abort the protocol. 
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Step 4: Creating the pads for Alice, C\, .., Cn, and Bob. 

1. The values in m message-positions result in iV + 2 m-bit pads P A = P A ,..,P A ; 

pC{€) = pC{i)^ ^ p C(i)^ e ^ ^j. pB = p B^ ^ pB for AlicG) ^ and Bob) 

respectively. These pads hold 0^ P c( - i] = P A ® P B . 
Step 5: Transmitting the key K. 

1. Alice creates the random m-bit key K, m ~ |. She sends K © P A to C\. 

2. For i from 1 to iV — 1, Cj receives K © P A © 0*^ P c ^, does a XOR operation over 
it and her pad, then sends the result to C i+ \. 

3. Cn receives K © P A © 0^J 1 1 P c ^\ does a XOR operation over it and her pad, then 
sends the result to Bob 

4. Bob receives K © P A © 0^ F C ( J ), computes K ® P A ® P B ® ®f =1 P c ^ = K. 

C. Correctness and security 

1. Correctness. 

One could claim that is it true that 0^L X c{i)j = © bi,i e [1, 2m], 2m ~ | in the step 
2 (sifting) of the QQTR protocol? 

We first look at 5 sites: Alice, P>i, C±, E>2, C 2 - We focus on the effect of the quantum 
circuit (see Fig. [2]) on the site C\. This circuit acts on |$ + )i ; 2, |$ + )3,4 coming from Bi, B 2 . 
The subscripts stand for the particle (qubit) numbering. Without loss of generality, we 
assume that after having discarded positions of different basis, the common basis is |+). 
This implies that C\, as all C 2 , .., Cjv, keep the result of the second output, and discard the 
first output of the quantum circuit. When the qubits 2, 3 go through the C-NOT gate, we 
have: 

|$ + >l, 2 |$ + >3,4 = ^(|0000) 1234 + |0011)i234 + I H00)i234 + |llH)l234) 

-(|0> 1 |00> 23 ]0> 4 + |0>i|01> 23 ]l> 4 + |l>i|ll> 23 |0> 4 + |1>i|10> 23 |1> 4 ) 
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The qubits 2,3 are measured in basis |x),|+), respectively. This makes the states 
|$ + }i,2, |$ + ) 3 ,4 collapsed into a mixed state either ±(|00)(00| + 1 1 1> < 1 1 1 ) or |(|01)(01| + 
1 10) (10 1) depending on the logical value of the second output being or 1, respectively. 
Note that if one gets the logical values of both two outputs then he can know exactly the 
qubits 1,4 being in what state (one out of four pure states |00), |01), |10), |11). However, 
the first output is measured in basis |x) and results in a random bit. This means that the 
logical value of the qubit 2 is deleted by a quantum manner. C\ gets only the logical XOR 
result of the qubits 2,3 that is capable of tracking the parity of the qubits 1,4. Indeed, if 
the XOR value is or 1, the global state of two qubits 1,4 is either |(|00)(00| + |11)(11|) or 
i(|01)(01| + |10)(10|) that has the logical parity either or 1, respectively. 

Therefore, when the quantum circuit of C\ has finished, we have a situation that could 
be described as follows. We denote the qubits 1,4 by \a) and \xi), respectively. Alice owns 
| a). The qubit \x±) is transmitted to C2 to enter, as the first input, into the quantum circuit 
at C2. C\ owns a classical bit c(l) that hold c(l) = a © x\ provided that \a) and \x\) are 
measured afterward in |+). We now observe the quantum circuit at C2. 

|a:i>|$ + >5 )6 = -^(|zi)|00)b6 + |x 1 >|ll> 56 ) 

^cnot x1>5 -^=(|xi)|x 1 ) 5 |0) 6 + |zi)|:ei + 1) 5 |1) 6 

After measurements are done at the two outputs, we have the following situation. We 
denote the remaining half of the EPR pair (the qubit 6) by \x2). \%2) is transmitted to C3. 
C\ owns the classical value c(2) that holds c(2) = x\ © X2 since the qubits 5, 6 are parallel. 

The quantum circuits at the sites C3 to do similarly as that at C2. This results in: 
c{i) = Xi-i © Xi,i G [2,iV]. Note that Bob owns \xn) = \b). Finally, when Alice and Bob 
measure their qubits, we have: 

c(l) = affixi; c(i) =Xi-i@Xi for % e [2,N- 1]; c(N) = x N -i © b 
Obviously, we have c(i) = a®b. 

2. Security. 

We distinguish possible attack types of Eve. 
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1. Type 1: Quantum attack on sites Bell 1,.., Bell N+l (B\, .., B^+i)- 

2. Type 2: Quantum attack on sites Carol 1, .., Carol N (Ci, ..,Cn)- 

3. Type 3: Quantum attack on channel. Eve could do quantum attacks on 2n+ 2 segments 
between Alice and Bob. 

4. Type 4: Classical attack, eavesdropping on sites C\, ..,Cn- 

The attack Type 1 implies imperfect EPR sources: the qubit pairs could be entangled 
with Eve's probes. In^, fortunately, Lo and Chau have proven that we can effectively check 
perfect EPR sources by executing random-hashing verification schemes. As a result, we 
could conclude that our QQTR protocol is secure faced to this attack type. 

As Carol in the enhanced-QQTB protocol, C\, .., Cn reveal no information than the XOR 
results. Their choices of the first or the second output depend on the randomness of the 
basis choices of Alice and Bob. This implies that all the single states (qubits) in the channels 
(attack type 3) and the C±, ..,Cjv (attack type 2) are unknown states for Eve. By the no- 
cloning theorem, Eve will make additional disturbances if she attacks on these states. In the 
step 3 of the QQTR protocol, we check the presence of Eve as the checking scheme of the 
enhanced-QQTB protocol. Therefore, we could conclude that our QQTR protocol is secure 
face to the attack types 2 and 3. 

Our protocol also is secure with the attack type 4 since the classical values a, b were not 
revealed outside of Alice and Bob. The knowledge of c(l), .., c(N) cannot deduce exactly the 
values of a, b. Here, we can say that the main idea of the QQTR protocol is exactly that of 
the single-photon QQTB protocols. This is the spirit of our "quasi-trusted" model. 

VII. QUANTUM UNTRUSTED BRIDGE (QUB) MODEL 

3. Model description. 

The QUB model is very similar to the QQTB one (see Section |VJ However, in this model 
we release the "finite-time trusted" condition of the intermediate node Carol. Instead, we 
require that Alice and Bob must effectively detect the case in which Carol tries to cheat. 
This implies that Eve could have full control on the Carol site or in the other word she 
plays the role of Carol (see Fig. [5]). We must design a protocol that allows Alice and Bob 
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to effectively detect to discard the cases in which Eve does not correctly follow the protocol 
and tries to read the transmitting keys. 

QKD link QKD link 

Alice ^ ^ Caro1 ( Eve ) ^ ^ Bob 

FIG. 5: Alice and Bob are out of the QKD range. They must securely transmit shared keys through 
Eve. This implies that they must effectively detect to discard the cases in which Eve tries to read 
the transmitting keys. 



4- The QUB protocol. 

The protocol consists of 5 main steps. 

Step 1: Preparing, exchanging, and measuring qubits. 

1. Alice creates 2n random bits and chooses the random 2n-bit string bA- For each bit i, 
she creates a state in a basis |+) or |x) for b^i] = or = 1, respectively. Alice 
sends the resulting qubits |ai,a2, ..,a 2n ) to Carol. 

2. Similarly, Bob creates a random 2n-bit value, the random 2n-bit string bs and the 
corresponding qubits b 2 , .., b 2n ). Then, he sends \bi, b 2 , .., b 2n ) to Carol. 

3. Carol receives two 2n-qubit strings from Alice and Bob in a synchronous manner. It 
means that she receives one by one for 2n pairs (|oj), For each pair, Carol first 
leads |aj), \ bi) to the C-NOT gate and then measures two output qubits in two different 
basis: the first one in | x) and the second one in |+) as described in Fig. [2J 

4. Carol sends the values obtained at both two outputs to Alice and Bob. The role of 
Carol stops here. 

Step 2: Sifting. 

1. Alice and Bob communicate their basis. 

2. If their basis are different at the position i, then they discard this position. 
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3. At a remaining position i, they keep only the second output or the first output of 
Carol for the common basis (at position i) being |+) or | x), respectively. This reduces 
a half of the value string came from Carol at both the sites of Alice and Bob. 

4. Therefore, the values of the remaining positions result in three 2m-bit strings a = 
«i, ••, o-2m] c = Ci, .., c 2m ; b = &i, .., 6 2m where Alice keeps two string a, c and Bob keeps 
two strings b, c. Theoretically, these three strings hold q = ai®h,i G [1, 2m], 2m ~ 

Step 3: Checking for the presence of Eve. 

1. Alice, Bob randomly agree m out of 2m positions to check the presence of Eve. This 
results in two m-position strings: the check-position string CP = cp±, ..,cp m and the 
message-position string MP = mpx, .., mp m . 

2. Alice, Bob announce their values a cpi ,b cpi , respectively, in check-positions cpi. They 
check if c cpi = a cpi © b cpi or not. If some of negative checks, they abort the protocol. 

Step 4: Creating the pads for Alice, Bob. 

1. The values in m message-positions result in three m-bit pads A = Ai, .., A m ; C = 
Ci, .., C m ; B = Bi, .., B m where Alice holds two strings A, C and Bob holds two strings 
B,C. Note that d = A © B u i G [1, ..,m],m ~ f . 

Step 5: Transmitting the key K. 

1. Alice creates the random m-bit key K. She sends K@A@C = K@B to ~B. 

2. Bob receives K © B, computes K © B © B to obtain K. 

5. Security. 

Note that the quantum circuit of Carol gives no more information than one XOR result 
either in basis |+) or | x), appearing at the second output or the first one, depending on the 
common basis of Alice and Bob being |+) or |x), respectively. In the modified-QQTB and 
enhanced-QQTB protocols, since Carol participates in the check process, she could cheat 
Alice and Bob. In the QUB protocol, Carol must announce her values before she knows 
the choices of basis of Alice and Bob. This implies that the quantum states of Alice and 
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Bob are really unknown to Carol. If she does not correctly follow the protocol, then her 
measured values must introduce some more errors. Note that Carol must always introduce 
one correct XOR result of two unknown states came from Alice and Bob, provided the Alice 
and Bob's choices of basis is the same. This allows the step 3 of the protocol effectively 
detect malicious operations of Carol. 

VIII. QUANTUM UNTRUSTED RELAY (QUR) MODEL 

6. Model description. 

The QUR model is very similar to the QQTR one (see Section IVTl) . However, this model 
releases the "finite-time trusted" condition of the intermediate nodes Carol. Instead, we 
require that Alice and Bob must effectively detect to discard the cases in which Carol does 
not correctly follow the protocol and tries to read the transmitting keys. In the other word, 
the QUR model works with untrusted intermediate nodes. 

7. QQTR protocol. 

Between Alice and Bob we arrange N Carols (Ci,..,Cjv for short) and N + 1 Bells 
(£>i, .., B N+ i for short) as described in FigJU This creates 2N + 2 segments. Without loss 
of generality, we assume that the length of segments are the same and the segment length 
allows our quantum devices working correctly and effectively with entanglement coherence 
and single-photon. All is similar to those of the QQTR model (see Section IVT]) . 

The QUR protocol consists of 5 steps: 

Step 1: Preparing, exchanging, and measuring qubits. 

1. For Bi, .., Bn + i, each prepares n Bell states (|$ + )) n . 

2. B\ sends the first half of each Bell state to Alice (the previous), the second half to 
C\ (the next). B N+ i sends the first half of each Bell state to Cn (the previous), the 
second half to Bob (the next). For i £ [2, N], Bi sends the first half of each Bell state 
to Cj_i (the previous), the second half to Cj (the next). 

3. Alice and Bob receive n qubits for each one. They randomly choose basis to measure 
their qubits, independently. 
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4. Each d,i G [1, N], receives 2n qubits from Bi and Bi + \ in a synchronous manner. This 
means that she receives n times, and for each time she leads the qubit from Bi and 
the qubit from B i+t to the first and second inputs of the quantum circuit as described 
in Fig. [2J Then, she sends both two output values to Alice and Bob. Briefly, Cj acts 
exactly as Carol in the QUB protocol. 

5. Alice and Bob receive N 2n-bit strings from C\, .., Cn, and informations about posi- 
tions and basis corresponding. 

6. The roles of B x , .., B N+1 , C\, .., Cn stop here. 
Step 2: Sifting. 

1. Alice and Bob announce their basis. 

2. If the basis are different at the position i, then Alice, Bob discard this position. 

3. For each remaining position i, Alice and Bob do on N strings came from C\, .., Cjy as 
follows. They keep only the value of either the first output or the second output if 
their common basis is |x) or |+), respectively. 

4. The values of the remaining positions result in TV + 2 2m-bit strings a = 
ai, ■■, o-2m] c(i) = c(z)i, .., c(z) 2m , i = 1..N; b — bi, .., 6 2 m where Alice holds N + 1 string 
a, c(l), .., c(N) and Bob holds N + 1 string b, c(l), .., c(N). These N + 2 strings should 
hold 0^ =1 c(i)j = a i ®b i ,ie{l, 2m] ,2m ~ f . 

Step 3: Checking for the presence of Eve. 

1. Alice and Bob randomly agree m out of 2m positions to check the presence of Eve. 
This results in two m-position strings: the check-position string CP = cpx, .., cp m and 
the message-position string MP = mpi, .., mp m . 

2. Alice and Bob announce values in check-position a = a cpi , .., a cpm ; b = 
bc P1 ,-;b C p m ;c(i) = c{i) cpi ,..,c{i) cpm ,i = 1..N, respectively. They check if 
e: =i c (i)cpj — a cpj © b cPj or not. If some of negative checks, they abort the protocol. 

Step 4: Creating the pads for Alice and Bob. 
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I. The values in m message-positions result in JV + 2 m-bit pads P A = Pf,..,P A ; 
pC(i) = pP®,^pP®,i G [1 } N); and P B = Pf,..,P£ where Alice holds N + 1 
pads P A , P c «, .., P c ^ and Bob holds N + 1 pads P B ', P C W, .., P c ^. These pads 
hold 0^ P c ^ = P A © P B . 

Step 5: Transmitting the key X. 

1. Alice creates the random m-bit key K , m ~ j. She sends if © P A ®? =1 P c ^ to Bob. 

2. Bob receives K ® P A ® ®? =1 P c ^\ computes K © P A © P B © P c ^) = 

5. Correctness. 

The QUR protocol is based on the QQTR protocol, therefore, the correctness is exactly 
the same. 

9. Security. 

Note that the random coincidences of basis choices between Alice and Bob determine 
the computation basis of EPR states. By the fact that Ci,..,CV must announce their 
measurement values before they know the basis of Alice and Bob, we have successfully 
removed the cheating possibility of C\,..,Cn as analyzed in the security discussion of the 
QUB protocol. Besides, our check process could also detect imperfect EPR source as that 
of the modified Lo-Chau BB84 protocol presented irA In brief, our QUT protocol has the 
same security level as the other EPR pair based BB84 protocol. 

IX. CONCLUSION 

We developed quasi-trusted and untrusted models for relaying QKD keys. We distin- 
guished protocols that are based on single photon and entangled photons. Our motivation is 
to avoid difficulties arising from conserving the quantum entanglement that is unavoidable 
dramatically decreased in time. The heart of our works is the quantum circuit as described 
as Fig. [2l This circuit receives two states and gives no more information than the XOR 
result of two input states, provided that the two input states are prepared in a common 
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basis. In particular, the common basis in one out of two conjugated basis determines the 
XOR result appearing at either the first output or the second output. This allows effectively 
detect malicious operations on relaying nodes.. 

Our results are very significant. These allow extend the range up to two time for single 
photon based QKD and up to un arbitrarily long distances for entanglement based QKD. 
Particularly, our entanglement-based protocols could keep almost totally the secret-key rate 
of the original BB84 protocol. Our protocols do not require having quantum devices that 
could keep entangled coherence in long time. 
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